Security of Sensor Networks (2008)

Category : key management , security

The WINES Infrastructure project deployed wireless sensor networks to monitor large bridges (Humber bridge), tunnels (London Underground), and water systems. Our task in the project was to perform a detailed analysis of security issues in existing hardware and software platforms for wireless sensor networks.

“Read More”

Trusted Path for Smart Cards

Category : passwords , security

The main problem with smart cards is lack of secure display and keyboard that would allow users to verify data sent to the smart card from their computer. Malware on the computer may then alter the data and, for example, change the recipient of a bank transfer.

“Read More”

Privacy in Common Criteria

Category : security

Still at Cambridge Uni, Vashek Matyas and myself looked at the definition of privacy in the Common Criteria standard. With Snowden and Echelon some years later, our definitions of unlikable anonymity and pseudonymity make even more sense.

“Read More”

Chrysalis Luna CA3

Category : key management , security

I moved some of the contents from an old website of mine. This is one of a small projects back from my time at the University of Cambridge, where we hacked a Chrysalis Luna CA3, which would now be part of SafeNet HSM portfolio.

“Read More”

Minerva Attack and Humble Beginnings

Category : crypto , security

Masaryk University has published a new cryptographic attack. You may still remember their ROCA attack from 2017. While ROCA was about the RSA encryption, MINERVA is about Elliptic Curve (ECC) signing.

“Read More”

Web Encryption – Punishment of SMBs by Tech Giants?

Mandating use of HTTPS / SSL certainly seems to have something in common with security certifications like FIPS140-2 or Common Criteria. Very few understand how it really helps, how complex it is but many already know how costly it can be.

“Read More”

Monzo and Challenger Banks’ Security

Category : governance , payments , security

Earlier today I read an article about Monzo leaking PINs of their customers into operational logs. Bad. What’s worse – this is the second Monzo’s technical problem I came across within last 12 months.

“Read More”

Smartcard Systems Redesigned

We have successfully delivered the first centralized smartcard signing solution about a year ago. From this week, Windows legacy applications can use smart cards in the cloud

“Read More”

KeyChest – Unifying Public and Private Keys

KeyChest has started as an easy to use HTTPS monitoring service. What we are aiming for is a general purpose key management service, which can look after your public as well as internal web encryption keys.

“Read More”

MySQL8 Cluster and Networking Problems

Category : keychest , security

This is my second post on the topic of reliable MySQL8 cluster. Hopefully the last one as things look much brighter now.

“Read More”